The Vulnerability lies within the Human workflow 11g+ component of Oracle Business Process Management Suite and permits an unauthenticated attacker possessing HTTP network access to perform unauthorized update, insert or delete operations and read restricted data. The attack requires a human actor, other than the attacker, to interact with the system, yet no system credential is needed to begin the exploitation sequence. Successful exploitation leads to confidentiality and integrity compromise for data exposed through the suite, as reflected by the CVSS 6.1 score and the CVSS vector components impacting confidentiality and integrity.

The affected installations are Oracle Business Process Management Suite versions 12.2.1.4.0 and 14.1.2.0.0, which are part of Oracle Fusion Middleware. The vulnerability may also affect other products that interact with or rely on the Human workflow component in these version lines.

The CVSS 3.1 base score of 6.1 indicates medium severity, and the lack of an available EPSS score means the exploitation probability cannot be quantified. The vulnerability is not flagged in the CISA KEV catalog. Because the attack vector is network via HTTP and requires no authenticated access, the risk of a successful attack is non‑negligible; however, the necessity of a human interaction limits the efficiency of automated exploitation campaigns.